EXECUTIVE SUMMARY:
Arechclient2, also known as sectopRAT, is a highly obfuscated Remote Access Trojan (RAT) written in .NET, designed to steal sensitive information from infected systems. The malware uses the calli obfuscator, making its analysis difficult. Despite efforts to deobfuscate the code with tools like CalliFixer, the sample remained largely unreadable but could be partially analyzed using dnSpy. Key strings extracted from the executable revealed its ability to gather browser data, such as stored credentials, cookies, and autofill information, as well as system details, including hardware specifications and installed software. The malware also scans for VPN services, game launchers, and applications like Discord and Telegram, along with FTP connections and cryptocurrency wallet configurations.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Arechclient2, also known as sectopRAT, is a highly obfuscated Remote Access Trojan (RAT) written in .NET, designed to steal sensitive information from infected systems. The malware uses the calli obfuscator, making its analysis difficult. Despite efforts to deobfuscate the code with tools like CalliFixer, the sample remained largely unreadable but could be partially analyzed using dnSpy. Key strings extracted from the executable revealed its ability to gather browser data, such as stored credentials, cookies, and autofill information, as well as system details, including hardware specifications and installed software. The malware also scans for VPN services, game launchers, and applications like Discord and Telegram, along with FTP connections and cryptocurrency wallet configurations.[emaillocker id="1283"]
Dynamic analysis revealed that the malware connects to a remote Command and Control (C2) server and downloads malicious files posing as a Google Docs Chrome extension. These files, including manifest.json, content.js, and background.js, facilitate data exfiltration by monitoring user input on all websites visited. Content.js injects event listeners to capture information such as usernames, passwords, and credit card details, which are sent to the attacker’s server. Background.js bypasses browser security policies, relaying stolen data to the C2 server. The extension, masquerading as a legitimate service, uses broad permissions to enable script injections and unauthorized communication with the attacker-controlled server.
While no additional payloads were observed during the analysis, the malware’s network behavior suggests the possibility of further payloads being delivered dynamically based on the victim’s environment. This highlights the evolving nature of the threat, where the malware can adapt and deploy more advanced malicious activities once it has infiltrated a system.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1566 | Phishing |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| Credential Access | T1555 | Credentials from Password Stores |
| Discovery | T1082 | System Information Discovery |
| Collection | T1005 | Data from Local System |
| Command & Control | T1071 | Application Layer Protocol |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
REFERENCES:
The following reports contain further technical details:
https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection